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Amended claims follow: 

1 . (currefttly amended) A computer program product comprising a con^nter 
program operable to coEtrol a computer to generate audit data indicative of a request to 
execute a concqmter program, said computer program comprising: 

(1) computer virus scanner logic, responsive to a conjputer virus scan request 
including data identifying a computer file to be scanned for computer viruses, for 
performing a computer virus scan and for generating a scan result; [and] 

(ii) audit data generator logic triggered by said computer virus scanner logic, 
and responsive to said data identifying said computer file to be scanned, for identifying a 
request to execute a computer program and, in response to identification of said request 
to execute said compmer program, for generating audit data identifying said computer 
progra m; and 

concurrent usage logic for oerforminp; a concurrent usage checV for 

identifying a request to execute a farfht- r computer pnjgram that would result m sai'H 
fiirtfaer computer program concurrentl y executing upon more than a p redeterminftH 
number of computers upon A computer network; 

wherein said predetermined number varies with time . 

2. (original) A computer program product as claimed in claim 1 , wherein a file 
access request to an operating system triggers generation of said computer virus scan 
request 
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3. (original) A computer program product as claimed in claim 1, wherein said 
audit data generator logic is responsive to data identifying one or more bamied computer 
programs to identify a request to execute a banned computer program. 

4. (original) A computer program product as claimed in claim 3, wherem, if a 
request to execute a banned computer program is identified, then one or more banned 
program actions are triggered, said banned program actions including one or more of; 

(i) said banned computer program is deleted; 

(ii) said banned computer program is disabled; 

(iii) said banned program is etJCiypted and replaced by a stub program; and 

(iv) an alert indicating detection of said banned computer program is issued. 

5. (original) A computer program prodiict as claimed in claim 3, wherein said data 
identifying one or more banned computer programs is a permitted computer program list 
with any computer program not included within said penaitted computer program list 
being a banned computer program, 

6. (cancelled) 

7. (currently amended) A computer program product as claimed in claim [61L 
wherein, if said concurrent usage check indicates that said request to execute said further 
computer program would result in more than said predetermined number of computers 
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upon said Computer network concurrently executing said computer program, then said 
request to execute said further computer program is denied. 

8. (previously presented) A computer program product as claimed in claim 7, 
wherein a user message is displayed when execution of said further computer program is 
prevented. 

9. (cancelled) 

10. (currently amended) A computer program product as claimed in claim [9] 1, 
wherein at certain times said predetennined number is zero. 

11. (original) A computer program product as claimed in claim 1, wherein said 
audit data g^ierator logic calculates a checksum value from said computer file, said 
checksum value being used in identification of said computer file as a particular 
computer program. 

12. (original) A computer program product as claimed in claim 1 1, wherein said 
audit data generator logic stores said calculated checksum value and uses said stored 
calculated checksum vahes instead of recalculating said checksum value when said 
computer file subject to a subsequent access without any intervening change having been 
made to said computer file. 
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13. (original) A computer program product as claimed in claim 1, wherein said 
audit data generator logic is responsive to a non-user specified database of data indicative 
of particular computer programs. 

14. (original) A computer program product as claimed in claim 1, wherein said 
audit data generator logic is responsive to a user specified database of data indicative of 
particular computer programs. 

15. (original) A computer program product as claimed in claim 1, wherein said 
computer yims scan request results from an on-access scan. 

16. (original) A computer program product as claimed in claim 1, wherein said 
computer vinx$ scan request results from an on-demand scan. 

17. (original) A computer program product as claimed in claim 1, wherein local 
audit data is stored upon a computer within a computer network until said computer is 
polled by a remote computer upon said computer network whereupon said local audit 
data is sent to said remote computer 

18. (original) A computer program product as claimed in claim 17, wherein said 
remote computer generates a consohdated audit report for a pluraUty of computers upon 
said computer network. 
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19. (currently amended) A method of generating audit data indicative of arequest 
to execute a computer program, said method comprising the steps of: 

(i) responsive to a computer virus scan request within a computer virus 
seamier, performing a computer virus scan and generating a scan result, said computer 
virus scan request including data identifying a computer file to be scanned for computer 
viruses; 

(ii) triggering operation of an audit data generator using said computer virus 
scanner, said audit data generator being responsive to said data identif)ang said computer 
file to be scanned to identify a request to execute a computer program; [and] 

(iii) in response to identification of said request to execute said computer 
program, generating audit data identifying said computer program : and 

fiv^ pferforming a concurrent usage check for identifying a request to execute a 
further computer program that would result in said further comnuter program 
concurrently executing upon more than a predetermined number of computers upon a 
computer network; 

wherein said predetermined number varies with time . 

20. (original) A method as claimed in claim 19, wherein a file access request to an 
operating system triggers generation of said computer virus scan request. 

21. (original) A method as claimed in claim 19, wherein said audit data generator 
is responsive to data identifying one or more banned computer programs to identify a 
request to execute a banned computer program. 
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22. (origitjaJ) A method as claimed m claim 21 , wherein, if a request to execute a 
bamied computer program is identified, then one or more banned program actions are 
triggered, said banned program actions including one or more of: 

(i) said banned computer program is deleted; 

(ii) said banned computer program is disabled; 

(iii) said baimed program is encrypted and replaced by a stub program; and 

(iv) an alert indicating detection of said banned computer program is issued. 

23. (original) A method as claimed in claim 21, wherein said data identifying one 
or more bamied computesr programs is a peimitted computer program list with any 
computer program not included within said permitted computer program list being a 
banned computer pro gram, 

24. (cancelled) 

25. (currently amended) A method as claimed in claim [24] 19, wherein, if said 
concurrent usage check indicates that said request to execute said further computer 
program would result in more than said predetermined number of computers upon said 
computer network concurrently executing said further computer program, then said 
request to execute said further computer program is denied. 
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26. (previously presented) A method as claimed in claim 25, wherein a user 
message is displayed when execution of said further computer program is prevented. 

27. (cancelled) 

28. (currently amended) A method as claimed in claim [27] 19, wherein at certain 
times said predetexmined number is zero. 

29. (original) A method as claimed in claim 19, wherein said audit data generator 
calculates a checksum value fiom said computer file, said checksum value being used in 
identificatiojEi of said computer file as a particular computer program. 

30. (original) A method as claimed in claim 29, wherein said audit data generator 
stores said calculated checksum value and uses said stored calculated checksum values 
instead of recalculating said checksum value when said computer file subject to a 
subsequent access without any intervening change having been made to said computer 
file. 

31. (original) A method as claimed in claim 19, wherein said audit data generator 
is responsive to a non-user specified database of data indicative of particular computer 
programs. 
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32. (original) A method as claimed in claim 19, wherein said audit data generator 
is responsive to a user specified database of data indicative of particular computer 
programs. 

33. (original) A method as claimed in claim 19, wherein said computer virus scan 
request results from an on-access scan. 

34. (original) A method as claimed in claim 19, wherein said computer virus scan 
request results from an on-demand scan. 

35. (original) A method as claimed in claim 19, wherein local audit data is stored 
upon a computer within a computer network until said computer is polled by a remote 
computer upon said computer network whereupon said local audit data is sent to said 
remote computer. 

36- (original) A method as claimed m claim 35, wherein said remote computer 
generates a consolidated audit report for a plurality of computers upon said computer 
network. 

37. (currently amended) Apparatus for generating audit data indicative of a 
request to execute a computer program, said apparatus comprising: 

(i) a computer vims scanner, responsive to a computer virus scan request, for 
performing a computer virus scan and for generating a scan result, said computer virus 
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scan request including data identifying a computer file to be scanned for computer 
viruses; [^d] 

(ii) an audit data generator triggered by said computer vims scanner logic, and 
responsive to said data identifying said computer file to be scanned, for identifying a 
request to execute a computer program and, in response to identification of said request 
to execute said computer program, for generating audit data identifying said computer 
progra m: and 

concurrent usage monitor for performing a concurrent usage check for identifying 
a request to execute a further computer program that would result in said further 
computer program concurrently executing upon more than a predetermined number of 
computers upon a computer network: 

wherein said predetermined nximber varies with time . 

38. (original) Apparatus as claimed in claim 37, wherein a file access request to 
an operating system triggers generation of said computer virus scan request, 

39. (original) Apparatus as claimed in claim 37, wherein said audit data generator 
is responsive to data identifying one or more banned computer programs to identify a 
request to execute a banned computer program, 

40. (original) Apparatus as claimed in claim 39, wherein^ if a request to execute a 
banned computer program is identified, then one or more banned program actions are 
triggered, said banned program actions tacluding one or more of: 
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(i) said banned computer program is deleted; 

(ii) said baiined computer program is disabled; 

(iii) ssdd banned program is encrypted and replaced by a stub program; and 

(iv) an alert indicating detection of said banned computer program is issued. 



41, (original) Apparatus as claimed in claim 39, wherein said data identifying one 
or more banned computer programs is a permitted computer program list with any 
computer program not included within said permitted computer program list being a 
banned computer program. 



42, (cancelled) 



43, (currently amended) Apparatus as claimed in claim [42] 37, wherein, if said 
concurrent usage check indicates that said request to execute said further computer 
program would result in more than said predetermined number of computers upon said 
computer tietwork concurrently executing said further computer program, then said 
request to execute said further computer program is denied. 



44. (previously presented) Apparatus as claimed in claim 43, wherein a user 
message is displayed when execution of said furtlier computer program is prevented 



45. (cancelled) 
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46. (currently amended) Apparatus as claimed in claim [45 ]37, wherein at certain 
times said predetennined ixumber is zero. 

47. (original) Apparatus as claimed in claim 37, wherein said audit data generator 
calculates a checksum value firom said computer file, said checksum value being used in 
identification of said computer file as a particular computer program. 

48. (original) Apparatus as claimed in claim 47, wherein said audit data generator 
stones said calculated checksum value and uses said stored calculated checksum values 
instead of recalculating said checksum value when said computer file subject to a 
subsequent access without any intervening change having been made to said computer 
file. 

49. (original) Apparatus as claimed in claim 37, wherein said audit data generator 
is responsive to a non-user specified database of data indicative of particular computer 
programs, 

50. (original) Apparatus as claimed in claim 37, wherein said audit data generator 
is responsive to a user specified database of data indicative of particular computer 
programs. 

51. (original) Apparatus as claimed in claim 37, wherein said computer virus scan 
request results firom an on-access scan. 
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52. (original) Apparatus as claimed in claim 37, wherein said computer virus scan 
request results ftom an on-demand scan. 

53* (original) Apparatus as claimed in claim 37, wherein local audit data is stored 
upon a computer within a computer network until said computer is polled by a remote 
computer upon said computer network whereupon said local audit data is sent to said 
remote computer, 

54, (original) Apparatus as claimed in claim 53, wherein said remote computer 
generates a consolidated audit report for a plurality of computers upon said computer 
network,, 

55. (cutrently amended) A computer program product comprising a computer 
program operable to control a computer to generate audit data indicative of a request to 
execute a computer program, said computer program comprising: 

(i) computer virus scanner logic, responsive to a computer virus scan request 
including data identifying a computer file to be scanned for computer viruses, for 
performing a computer virus scan and for generating a scan result; 

(ii) audit data generator logic triggered by said computer virus scanner logic, 
and responsive to said data identifying said compute file to be scanned, for identifying a 
request to execute a computer program and, in response to identification of said request 
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to execute said computer program, for generating audit data identifying said computer 
program; and 

(iii) concurrent usage logic for perforxning a concurrent usage check for 
identifying a request to execute a further computer program that would result in said 
further computer program concurrently executing upon more than a predetermined 
number of computers upon a computer networki 

wherein gaid predetermined number varies with time . 

56. (currently amended) A method of generating audit data indicative of a request 
to execute a computer program, said method comprising the steps of; 

(i) responsive to a computer virus scan request within a computer virus 
scanner, performing a computer vims scan and generating a scan result, said computer 
viras sQ$n request including data identifying a computer file to be scanned for computer 
virases; 

(ii) triggering operation of an audit data generator using said computer virus 
scanner, said audit data generator being responsive to said data identifying said computer 
file to be scanned to identify a request to execute a computer program; 

(iii) in response to identification of said request to execute said computer 
program, generating audit data identifying said computer program; and 

(iv) performing a concurrent usage check for identifying a request to execute a 
further computer program that would result in said further computer program 
concurrently executing upon more than a predetermined number of computers upon a 
computer network; 
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wherein said predetermitied number varies with time . 
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57. (currently amended) Apparatus for generating audit data indicative of a 
request to execute a computer program, said apparatus comprising: 

(i) a cotnputer virus scanner, responsive to a computer virus scan request, for 
performing a computer virus scan and for generating a scan result, said computer virus 
scan request including data identifying a computer file to be scanned for computer 
viruses; 

(ii) an audit data generator triggered by said computer virus scanner logic, and 
responsive to said data identifyitxg said computer file to be scanned, for identifying a 
request to execute a computer program and, in response to identification of said request 
to execute said computer program, for generating audit data identifying said computer 
program- and 

(iii) a concurrent usage monitor for performing a concurrent usage check for 
identifying a request to execute a fiirther computer program that would result in said 
further computer program concurrently executing upon more than a predetermined 
number of computers upon a computer network; 

wherein said predetennined number varies with time . 
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